EUVD-2026-94956
GHSA-m64c-924x-35gx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed GraphQL endpoint on DataPower
-
ExploitSend crafted request with malformed variables
-
ExecutionTrigger NULL pointer dereference in GraphQL processing
-
ImpactCrash service and deny availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the targeted DataPower Gateway be configured to process GraphQL and that the attacker can send requests to that GraphQL-enabled service; the flaw is reached specifically through GraphQL variable processing, so endpoints without GraphQL handling are not exposed. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the HIGH attack complexity (AC:H) means the attacker must craft input that reliably triggers the NULL pointer dereference, which limits trivial or opportunistic exploitation. Affected builds are limited to DataPower Gateway 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2; impact is limited to denial of service with no data exposure or modification. |
| Impact | This is a moderate, availability-only issue, not a top-tier priority despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.9) shows an unauthenticated, remote trigger but with HIGH attack complexity and impact confined to availability - no confidentiality or integrity loss. The CWE-476 NULL pointer dereference in GraphQL variable processing is consistent with a crash/denial-of-service rather than code execution. No EPSS score was supplied in the input, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The AC:H rating signals that crafting the malformed GraphQL input to reliably reach the NULL deref is non-trivial, which further tempers real-world urgency. Signals are internally consistent (network DoS, no active exploitation), so prioritize this as a standard patch-cycle item for exposed DataPower GraphQL endpoints rather than an emergency, with elevated attention only where DataPower fronts business-critical APIs whose downtime is costly. |
| Exploit ScenarioDerived | An attacker who can reach a DataPower Gateway endpoint that processes GraphQL sends a specially crafted GraphQL request with malformed or unexpected variables, triggering a NULL pointer dereference that crashes the processing path and causes a denial of service. The HIGH attack complexity means the attacker must shape the input precisely to reach the vulnerable code, and no public exploit code is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Denial of service affecting IBM DataPower Gateway builds 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2, where a crafted GraphQL request containing a malformed variable causes a NULL pointer dereference that crashes or hangs the affected service. The flaw is network-reachable and requires no authentication (PR:N) and no user interaction (UI:N), but the HIGH attack complexity (AC:H) means the attacker must craft input that reliably reaches the dereference, so opportunistic mass exploitation is unlikely. Impact is availability-only with no data disclosure or modification, and no public exploit identified at time of analysis; this is a moderate, availability-only issue rather than a top-tier priority.
RemediationAI
Consult IBM's advisory at https://www.ibm.com/support/pages/node/7289775 for the exact fixed firmware level in each affected branch (10.5.0.x, 10.6.0.x, 10.6.1-10.6.6, 11.0.0.x) and upgrade accordingly; the specific patched build numbers are not enumerated in the data available here, so do not rely on any assumed version and verify against the advisory before scheduling the change window. Where an immediate upgrade is not possible, the most effective compensating control is to disable GraphQL processing on any DataPower service that does not strictly require it - the trade-off is loss of GraphQL API functionality for consumers of that service. If GraphQL must remain enabled, restrict inbound access to the GraphQL endpoints with network ACLs, firewall policy, or DataPower access-control rules so only trusted client networks can reach them; this reduces the exposed attack surface but does not eliminate risk for those legitimate clients and can break externally published APIs. Deploying a WAF or reverse proxy that rejects malformed or deeply nested GraphQL variable payloads adds a validation layer, though GraphQL-aware signature coverage is imperfect and may cause false positives against valid queries. Rate limiting alone is not a reliable mitigation because a single crafted request can trigger the dereference, and it adds latency to legitimate traffic. Finally, monitor gateway logs and health checks for unexpected restarts or process faults on GraphQL handlers so attempted exploitation is detectable, and treat any such event as a potential indicator of compromise attempt.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-476, a NULL pointer dereference occurring specifically within GraphQL variable processing on IBM DataPower Gateway, an enterprise API gateway, security gateway, and multi-protocol integration appliance. DataPower exposes GraphQL handling as one of its API front-end capabilities; when a request supplies variables that the GraphQL variable-parsing/coercion logic does not validate before dereferencing, the handler follows a null reference and the process faults, degrading or terminating the affected service. Only gateways configured to process GraphQL are in scope - the code path is reached through GraphQL variable handling, so deployments whose services do not enable GraphQL are not exposed. The assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H confirms the exposure is remote, unauthenticated, and confined to availability (C:N/I:N/A:H), with AC:H reflecting the difficulty of constructing input that deterministically triggers the null dereference rather than a trivial request. The affected firmware branches are 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6 (10.6CD), and 11.0.0.0-11.0.0.2, as catalogued in EUVD-2026-94956; no CPE identifiers were supplied in the available intelligence. Because a crash of a gateway process can disrupt all traffic traversing that data plane, the practical business impact can exceed the modest 5.9 base score if the device is a single choke point for production APIs.
Know when Datapower Gateway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Remotely reachable GraphQL processing gives AV:N/PR:N/UI:N; precise crafting to hit the NULL deref justifies AC:H; crash-only impact is A:H with C:N/I:N.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a NULL pointer dereference in GraphQL variable processing.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Datapower Gateway
View allRemote, unauthenticated code execution is possible in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account tha
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21
IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attac
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21
IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attac
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15
A heap buffer overflow in IBM DataPower Gateway (affected firmware levels 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 1
Denial of service in IBM DataPower Gateway allows a remote, unauthenticated attacker to crash or degrade an affected gat
Denial of service in IBM DataPower Gateway allows a remote, unauthenticated attacker to crash or exhaust the message-pro
Unauthenticated remote attackers can exhaust system resources on IBM DataPower Gateway firmware releases 11.0.0.0 throug
Exploit-DB